0

Normally, I would:

  • Change the SSH to protocol 2, disallow root login, change the port and only allow public keys.
  • Install fail2ban.
  • Install Bastille-Linux and run through it (setting up firewall etc.)
  • Run chkrootkit and rkhunter on cron.

What else can I do to help secure a Debain server (VPS)?

1

4 Answers 4

0

There are tools to keep up to date with both operating system and application patches and configuration tests. Some of them include best practices. You can run them on a regular basis to get a picture of your security posture. You can even write your own rules, after much study, to ensure that systems maintain your planned configuration.

The US Department of Homeland Security is the front for a very large effort to develop open standards for security products. They and their contractor Mitre have developed a language called OVAL that is the Open Vulnerability and Assessment Language. It uses a combination of "platforms" like Windows, Linux, and Cisco IOS that various scanning engines have to support. These scanning engines then take "definitions" of specific tests to execute against the host or target and produce a report.

If all of this sounds very generic, it is. On purpose. This allows Debian to issue their own "definitions" on their website once. They don't care what tool does the scanning or reporting. No GUIs required. A free scanner and results writer, the OVAL Interpreter, can be downloaded from sourceforge.net. Instructions are also available.

Now that you have tools to verify that your applications are as secure as possible, you can continue providing protection at the network layer against specific attacks.

2

Run through the Securing Debian Howto.

Install all patches and keep patched. I install unattended-upgrades and enable security related updates.

I usually install Shorewall as a firewall with an appropriate example configuration as a starting point. Then I limit access to the Internet to expected traffic.

1
  • Thanks for your help. I will look into using "unattended-upgrades".
    – jSherz
    Oct 9, 2010 at 15:22
1

Those are all good suggestions, and it looks like you're on the right path already. However, don't neglect the applications/services running on the box. Unless you have a user with a default or very easily guessable password, most cracks are not going to come via SSH. They're going to come via a web application, or mail server, or some other service that is running and publicly available on the box.

Securing the base OS is only step 1. Securing the applications is even more critical for long term security.

1
  • The only applications that are accessible remotely are SSH and the HTTP server - therefore I will take especial care to monitor those. Thanks for pointing this out.
    – jSherz
    Oct 9, 2010 at 15:22
0

Run nessus or any other vulnerability scanner to make sure your harden your server well enough.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .